NodePackages spawning reconnaissance processes

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•3•0•17

Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing.